Getting Data In

Configuring Input stanza for forwarder

rajindersingh
Explorer

I used this command to configure splunk forwarder using cli

splunk add monitor d:\logs -Follow-only True

I got no errors but I don't see any changes in my input.conf

I tried add the monitor again and I got a message that monitor is already present.

I can telnet from my forwarder vm to splunk vm over port 9997 and 8089

In my splunkd log file

05-09-2015 04:18:29.694 +0000 ERROR TcpOutputFd - Read error. An established connection was aborted by the software in your host machine.
05-09-2015 04:18:59.702 +0000 ERROR TcpOutputFd - Read error. An established connection was aborted by the software in your host machine.
05-09-2015 04:19:29.708 +0000 ERROR TcpOutputFd - Read error. An established connection was aborted by the software in your host machine.
05-09-2015 04:19:38.075 +0000 WARN TcpOutputProc - Forwarding to indexer group default-autolb-group blocked for 9400 seconds.
05-09-2015 04:19:59.720 +0000 ERROR TcpOutputFd - Read error. An established connection was aborted by the software in your host machine.

I know that firewall on my splunk server allows connections over port 8089 and 9997.

Do I have to configure outgoing firewall on the server running splunk forwarder?

Thanks

Tags (3)
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

Port 8089 is the management port for Splunkd.

You should be forwarding to the Splunkinput port configured on your indexer. Typically this is TCP9997.

Update your outputs to that, and should resolve your issue.

View solution in original post

rajindersingh
Explorer

Thanks esix_splunk

rookie mistake.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Port 8089 is the management port for Splunkd.

You should be forwarding to the Splunkinput port configured on your indexer. Typically this is TCP9997.

Update your outputs to that, and should resolve your issue.

rajindersingh
Explorer

Output.conf was configured by the splunk universal forwareder installer.

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 10.0.0.37:8089

[tcpout-server://10.0.0.37:8089]

This server is up and running. It allows firewall traffic over 8089 and 9997.

Any other suggestions?

Thanks

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You also need to have an outputs.conf configured on your forwarder. This lets the UF know where it should send the data collected in the inputs.conf to.

In your case, the outputs.conf should point to your indexer.

See : http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Deployaforwarder

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...